A Ransomware Attack Exposed What Most Plans Are Missing

In February 2024, Change Healthcare suffered a ransomware attack that disrupted prescription processing for millions of Americans. UnitedHealth Group later confirmed the breach affected approximately 100 million individuals — the largest healthcare data breach in U.S. history. The attackers got in through a Citrix portal that lacked multi-factor authentication.

What made the damage so catastrophic wasn't just the initial compromise. It was the gap between having a response plan on paper and actually executing cyber incident response steps under pressure. I've seen this pattern repeat across organizations of every size. The plan exists. The muscle memory doesn't.

This post walks you through the incident response steps that work in practice — not just in theory. Whether you're building your first plan or stress-testing an existing one, these are the phases, actions, and mistakes that matter most.

What Are Cyber Incident Response Steps?

Cyber incident response steps are the structured phases an organization follows when a security event — a data breach, ransomware infection, credential theft, or insider threat — is detected. The most widely adopted framework comes from NIST's Cybersecurity Framework, which breaks response into four core phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.

The goal isn't perfection. It's speed. According to IBM's 2024 Cost of a Data Breach report, organizations that contained a breach in under 200 days saved an average of $1.02 million compared to those that took longer. Every hour you fumble costs real money.

Phase 1: Preparation — Before the Threat Actor Knocks

Preparation isn't a phase most teams take seriously until after their first real incident. I've walked into organizations where the "incident response plan" was a 60-page PDF that nobody had read since it was written three years ago.

Build the Response Team First

Identify your incident response team by name, not just by role. Include IT, legal, communications, and executive leadership. Everyone needs to know their responsibilities before an attack happens — not during one.

Run Tabletop Exercises Quarterly

Tabletop exercises force your team to walk through realistic scenarios. A phishing simulation escalates to credential theft. Credential theft leads to lateral movement. Lateral movement triggers ransomware. Your team needs to practice each decision point. Organizations that invest in phishing awareness training for their workforce catch social engineering attempts earlier, which means fewer incidents reach the response phase at all.

Document and Distribute

Your plan needs to live where people can find it — even when your network is down. Print copies. Store them offline. Include contact trees, vendor contracts, and insurance policy numbers. If ransomware encrypts your digital plan, it's useless.

Phase 2: Detection and Analysis — Finding the Signal in the Noise

Most breaches aren't discovered by the victim. The 2024 Verizon Data Breach Investigations Report found that external parties — law enforcement, customers, or threat intelligence firms — still notify a significant percentage of victims. That's a problem.

Know Your Baselines

You can't detect anomalies if you don't know what normal looks like. Baseline your network traffic, authentication patterns, and data flows. When a threat actor starts exfiltrating data at 2 AM on a Sunday, your monitoring tools need to flag it.

Triage and Classify Fast

Not every alert is an incident. Not every incident is a crisis. Use a severity classification system — I recommend a four-tier model: informational, low, high, and critical. This prevents your team from burning out on false positives while missing the real attack.

Security awareness plays a direct role here. When employees know how to recognize and report phishing emails, your detection timeline shrinks dramatically. Investing in cybersecurity awareness training turns your entire workforce into a human detection layer.

Preserve Evidence Immediately

The moment you suspect a real incident, start preserving evidence. Capture memory dumps, log files, and network captures before you start containment. I've seen legal cases fall apart because someone reimaged a compromised workstation before forensics could examine it.

Phase 3: Containment, Eradication, and Recovery

This is where your cyber incident response steps face their hardest test. You're under pressure, leadership wants answers, and the threat actor may still be inside your network.

Short-Term Containment

Isolate affected systems immediately. Pull them from the network but don't power them off — you'll lose volatile memory. If credential theft is confirmed, force password resets on all affected accounts and revoke active sessions. Enable multi-factor authentication on every system that supports it, especially remote access portals. Remember — the Change Healthcare breach started because MFA wasn't enabled on a single portal.

Eradication: Remove the Root Cause

Containment stops the bleeding. Eradication removes the infection. This means identifying every backdoor, persistence mechanism, and compromised account the threat actor established. Don't rush this step. I've seen organizations declare an incident "resolved" only to discover the attacker maintained access through a forgotten service account.

Recovery: Rebuild With Verification

Restore systems from known-good backups. Rebuild compromised servers from scratch rather than trying to clean them. Monitor recovered systems intensely for at least 30 days. Threat actors frequently test whether their access survived your response efforts.

Phase 4: Post-Incident Activity — The Step Everyone Skips

According to CISA's incident response guidance, post-incident review is essential for improving organizational resilience. In my experience, fewer than half of organizations actually conduct a thorough review after an incident.

Conduct a Blameless Post-Mortem

Gather every stakeholder within two weeks of resolution. Document the full timeline: initial compromise, detection, escalation, containment, and recovery. Focus on process gaps, not individual mistakes. If someone clicked a phishing link, the question isn't "why did they click?" — it's "why did our controls allow that click to cause damage?"

Update the Plan Based on Evidence

Every incident should produce at least three concrete improvements to your response plan. Maybe you discovered that your log retention was too short. Maybe your communication tree had outdated phone numbers. Maybe your team didn't know how to invoke your zero trust segmentation policies under pressure. Fix it now, while the pain is fresh.

Report Appropriately

Depending on your industry and the nature of the breach, you may have regulatory notification obligations. The FTC's Health Breach Notification Rule and various state laws impose strict timelines. Missing a notification deadline can turn a security incident into a legal crisis.

How Long Should Incident Response Take?

There's no universal answer, but here are benchmarks from IBM's 2024 research. The average time to identify a breach was 194 days. The average time to contain it was 64 days. The best-performing organizations — those with tested response plans, security awareness programs, and automated detection — cut both numbers roughly in half.

Your target should be detection within hours, containment within 24-48 hours, and full recovery within two weeks. Those targets are aggressive but achievable if your team has practiced the steps before the real event.

The Mistakes That Make Incidents Worse

  • Paying ransom without consulting law enforcement. The FBI's IC3 consistently recommends against paying and encourages reporting to ic3.gov.
  • Skipping multi-factor authentication on critical systems. It remains the single most effective control against credential-based attacks.
  • Treating incident response as an IT-only problem. Legal, communications, HR, and executive leadership all have roles.
  • Neglecting social engineering as an attack vector. Phishing remains the top initial access method in the Verizon DBIR year after year.
  • Never testing the plan. An untested plan is a guess, not a strategy.

Your Next Move

Cyber incident response steps aren't theoretical. They're the difference between a contained security event and a headline-making catastrophe. Start with preparation: train your people, test your plan, and build detection capabilities that don't rely on an outsider telling you that you've been breached.

If you haven't invested in your human layer yet, start with cybersecurity awareness training for your team and deploy phishing simulation exercises to measure real-world readiness. The best incident response plan in the world can't help you if your employees hand over the keys before you even know there's a threat.